第一步、首先生成一对证书。
你需要使用到openssl命令，所以请确认系统已经安装过此包
RHEL6中在/etc/pki/tls/certs 目录有个脚本可以帮助我们简化证书生成的过程，所以
我们首先切换到此目录
- [root@rhel6u3-7 ~]# cd /etc/pki/tls/certs/
- [root@rhel6u3-7 certs]# make server.key //生成私钥
- umask 77 ; \
- /usr/bin/openssl genrsa -aes128 2048 > server.key
- Generating RSA private key, 2048 bit long modulus
- ..........+++
- .....................................+++
- e is 65537 (0x10001)
- Enter pass phrase:
- Verifying - Enter pass phrase:
- [root@rhel6u3-7 certs]# openssl rsa -in server.key -out server.key //除去密码以便询问时不需要密码
- Enter pass phrase for server.key:
- writing RSA key
- [root@rhel6u3-7 certs]# make server.csr //生成证书颁发机构,用于颁发公钥
- umask 77 ; \
- /usr/bin/openssl req -utf8 -new -key server.key -out server.csr
- You are about to be asked to enter information that will be incorporated
- into your certificate request.
- What you are about to enter is what is called a Distinguished Name or a DN.
- There are quite a few fields but you can leave some blank
- For some fields there will be a default value,
- If you enter '.', the field will be left blank.
- -----
- Country Name (2 letter code) [XX]:cn
- State or Province Name (full name) []:sh
- Locality Name (eg, city) [Default City]:sh
- Organization Name (eg, company) [Default Company Ltd]:rsyslog
- Organizational Unit Name (eg, section) []:rsyslog
- Common Name (eg, your name or your server's hostname) []:xiaonuo
- Email Address []:unix.root@hotmail.com
- Please enter the following 'extra' attributes
- to be sent with your certificate request
- A challenge password []:123.com
- An optional company name []:it
- [root@rhel6u3-7 certs]# openssl x509 -in server.csr -req -signkey server.key -days 365 -out server.crt //颁发公钥，不过由于我们并不是去CA证书中心申请的公钥，所以在使用的时候，客户端浏览器会跳出未受信任的警告。如果你在生产环境下，请去CA申请。
- Signature ok
- subject=/C=cn/ST=sh/L=sh/O=rsyslog/OU=rsyslog/CN=xiaonuo/emailAddress=unix.root@hotmail.com
- Getting Private key
- [root@rhel6u3-7 certs]#
第二步、编辑nginx主配置文件，添加ssl模块参数
- [root@rhel6u3-7 certs]# vim /usr/local/nginx/conf/nginx.conf
- include /usr/local/nginx/server/www2.rsyslog.org; //将虚拟主机单独设置，然后用include包含到主配置文件中，简化主配置文件的配置
- [root@rhel6u3-7 certs]# vim /usr/local/nginx/server/www2.rsyslog.org //注意以下配置可以在主配置文件中复制ssl模块信息
- server {
- listen 443; 监听端口为443
- server_name www2.rsyslog.org;
- ssl on; //开启ssl
- ssl_certificate /etc/pki/tls/certs/server.crt; //证书位置
- ssl_certificate_key /etc/pki/tls/certs/server.key; //私钥位置
- ssl_session_timeout 5m;
- ssl_protocols SSLv2 SSLv3 TLSv1; //指定密码为openssl支持的格式
- ssl_ciphers HIGH:!aNULL:!MD5; //密码加密方式
- ssl_prefer_server_ciphers on; //依赖SSLv3和TLSv1协议的服务器密码将优先于客户端密码
- location / {
- root sites/www2; //www2.rsyslog.org根目录的相对位置
- index index.html index.htm;
- }
- }
第三步、创建网站的目录、主页、权限。
- [root@rhel6u3-7 ~]# cd /usr/local/nginx/sites/
- [root@rhel6u3-7 sites]# mkdir www2 //创建网站根目录
- [root@rhel6u3-7 sites]# echo This is https://www2.rsyslog.org >www2/index.html //写个主测试页面
- [root@rhel6u3-7 server]# chown nginx. /usr/local/nginx/server/ -R //设置配置文件的属主和属组为nginx
- [root@rhel6u3-7 server]# chmod 600 /usr/local/nginx/server/ -R //设置配置文件的权限为600
- [root@rhel6u3-7 server]# chown nginx. /usr/local/nginx/sites/www2 –R //设置网站根目录的属主和属组为nginx
- [root@rhel6u3-7 server]# chmod 755 /usr/local/nginx/sites/www2 –R //设置网站根目录权限为755，其他人可以读取网站信息。
第四步、在DNS区域中添加主机A记录，有关DNS配置请参看http://dreamfire.blog.51cto.com/418026/1091943
- www2 A 192.168.100.107
第五步、启动nginx服务器。
- [root@rhel6u3-7 certs]# /etc/rc.d/init.d/nginx reload //平滑重启nginx保证网站不被中断
- nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
- nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
- Reloading nginx: [ OK ]
第六步、http访问强制转到https。
-
nginx的rewrite方法
server {
listen 192.168.1.111:80;
server_name test.com;
rewrite ^(.*)$ https://$host$1 permanent;
} - nginx的497状态码
当此虚拟站点只允许https访问时，当用http访问时nginx会报出497错误码，利用error_page命令将497状态码的链接重定向到https域名上
server {
listen 192.168.1.11:443; #ssl端口
listen 192.168.1.11:80; #用户习惯用http访问，加上80，后面通过497状态码让它自动跳到443端口
server_name test.com;
#为一个server{......}开启ssl支持
ssl on;
#指定crt格式的证书文件
ssl_certificate /etc/pki/tls/certs/server.crt;
#指定PEM格式的私钥文件
/etc/pki/tls/certs/server.key;
#让http请求重定向到https请求
error_page 497 https://$host$uri?$args;
}
